2KKUU7ita

94
Part II: Putting Ethical Hacking in Motion
Understanding Password Vulnerabilities
When you balance the cost of security and the value of the protected
information, the combination of a user ID and a secret password is usually
adequate. However, passwords give a false sense of security. The bad guys
know this and attempt to crack passwords as a step toward breaking into
computer systems.
One big problem with relying solely on passwords for information security
is that more than one person can know them. Sometimes, this is intentional;
often, it’s not. The tough part is that there’s no way of knowing who, besides
the password’s owner, knows a password.
Remember that knowing a password doesn’t make someone an authorized user.
Here are the two general classifications of password vulnerabilities:
✓ Organizational or user vulnerabilities: This includes lack of password
policies that are enforced within the organization and lack of security
awareness on the part of users.
✓ Technical vulnerabilities: This includes weak encryption methods and
unsecure storage of passwords on computer systems.
I explore each of these classifications in more detail in the following sections.
Before computer networks and the Internet, the user’s physical environment
was an additional layer of password security that actually worked pretty well.
Now that most computers have network connectivity, that protection is gone.
Refer to Chapter 6 for details on managing physical security in this age of networked
computers and mobile devices.
Organizational password vulnerabilities
It’s human nature to want convenience, especially when it comes to remembering
five, ten, and often dozens of passwords for work and daily life. This
desire for convenience makes passwords one of the easiest barriers for an
attacker to overcome. Almost 3 trillion (yes, trillion with a t and 12 zeros)
eight-character password combinations are possible by using the 26 letters
of the alphabet and the numerals 0 through 9. The keys to strong passwords
are: 1) easy to remember and 2) difficult to crack. However, most people just
focus on the easy-to-remember part. Users like to use such passwords as
password, their login name, abc123, or no password at all! Don’t laugh; I’ve
seen these blatant weaknesses and guarantee they’re on any given network
this very moment.